devarea

DevArea — HackTheBox プラットフォーム: HackTheBox OS: Linux ステータス: リタイア済み — 完全なウォークスルー公開中。 完全なウォークスルー: l3dsec.com/walkthroughs/devarea-htb 攻撃チェーン root@kitploit: nmap → 21 FTP anon + 80 + 8080 Jetty + 8888 Hoverfly → FTP anon → employee-service.jar Apache CXF, pre-3.5.5 → CVE-2022-46364 SSRF →...

CVE-2026-94108: Improper Restriction of XML External Entity Reference

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

CVE-2026-94109: Improper Neutralization of Special Elements Used in a Template Engine

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the...

GHSA-6623-4Q32-82V8 Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a...

Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a...

CVE-2026-93981

hono/jsx (a server-side rendering component of the hono web framework) before version 4.13.7 fails to HTML-escape plain strings in several rendering paths: child or fallback of Suspense , string child of ErrorBoundary alongside an async sibling, the single child of Context.Provider , and the root...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

CVE-2026-93981: Improper Neutralization of Input During Web Page Generation

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...

PT-2026-105486

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a...

PT-2026-95818

Name of the Vulnerable Software and Affected Versions hono versions prior to 4.13.7 Description The software fails to HTML-escape plain strings rendered by hono/jsx in specific scenarios: as a child or fallback of Suspense, as a string child of ErrorBoundary when an asynchronous sibling is presen...

WordPress Wow Elements Addons for Elementor plugin <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery vulnerability

Authenticated Contributor+ Server-Side Request Forgery vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Waris Damkham in WordPress Plugin Wow Elements Addons for Elementor versions = 1.11.2...

CVE-2026-93759

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93759

Mongoid , the Ruby ODM for MongoDB, is vulnerable to server-side JavaScript injection via its query builder. A string-typed query criterion is not neutralized before being passed to the database as a server-side JavaScript expression. An unauthenticated attacker who can influence a query argument...

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

EUVD-2026-83214

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

SUSE CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...